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We present here an information theoretic study of Gaussian collective attacks on the continuous 
variable key distribution protocols based on Gaussian modulation of coherent states fT,'^,'?]. These 
attacks, overlooked in previous security studies, give a finite advantage to the eavesdropper in the 
experimentally relevant lossy channel, but are not powerful enough to reduce the range of the reverse 
reconciliation protocols. Secret key rates are given for the ideal case where Bob performs optimal 
collective measurements, as well as for the realistic cases where he performs homodyne Q, Ql or 
heterodyne measurements f3]. We also apply the generic security proof of Christiandl et al. 0] to 
obtain imconditionally secure rates for these protocols. 
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Over the past few years, quantum continuous vari- 
ables (CV) have been explored as an alternative to qubits 
for quantum key distribution (QKD) jQ, 0i More 
specifically, protocols using coherent states and homo- 
dyne 1 1, 2, 8] or heterodyne |3] measurements have been 
proposed and experimentally demonstrated |9, 10]. Re- 
lying on technologies allowing much higher rates than 
allowed by the single photon detectors used in qubit 
based QKD, those protocols are the only ones which 
could allow key rates in the GHz range in the foresee- 
able future. 

However, the security proofs of these new protocols 
are not yet as strong as the ones of the qubits-based 
protocols: they are almost all limited to individual or 
finite-size fllll attacks. To our knowledge, the only un- 
conditional security proofs of CV QKD protocols are 
12, 13], only the latter studying coherent-states based 
protocols. These proofs all rely on specific suboptimal 
key extraction procedures, and, for each case, it's diffi- 
cult to separate the effects of the technical inefficiencies of 
the encoding scheme from the more fundamental effect 
of real attacks possibility of Eve — the eavesdropper. 

In this letter, we study the effects of a Gaussian collec- 
tive attack on the key rate of CV QKD protocols based 
on the Gaussian modulation of coherent-states ]1, 2,^ 
sent through a lossy channel. In these attacks. Eve uses 
a Gaussian unitary to interact with each of the transmit- 
ted pulse and stores her ancillas into a quantum mem- 
ory. She performs then a collective measurement on her 
ancillas after Alice and Bob — the partners performing 
QKD — have used the public classical channel to fulfill 
the protocol. 

After introducing the notations used in this letter, we 
recall the values of various information theoretic quan- 
tities for Gaussian states. Then, we compute the secret 
key rate which can be achieved using direct reconcilia- 
tion when Bob is allowed to do collective, heterodyne 
or homodyne measurements. Those results are then ex- 



tended to reverse reconciliation protocols and compared 
with the unconditionally secure rates obtained from the 
generic security proof of Christiandl et al. fl. 

While completing this work, we learned Navascues 
and Acin used very similar techniques to study the se- 
curity boxmds of these protocols Il3l . 

Notations. In all the QKD protocols discussed in this 
letter, Alice sends n Gaussian modulated coherent states 
through a lossy channel of transmission T. 

Bob then makes measurements on the pulses he re- 
ceives. It can be an optimal collective measurement or, 
more realistically, a series of heterodyne ]3] or homo- 
dyne (7,'^,'^ measurements. Alice and Bob then agree 
on a secret key through a (direct or reverse) reconcilia- 
tion procedure. We are interested in the asymptotic key 
rates obtained at the limit n ^ co. 

In the following, A refers to the quantum state of the 
light pulse prepared by Alice, B and E to the one received 
by Bob and Eve. X refers to the (classical) value of Alice's 
modulation and Y to the one of Bob's measurement. For 
instance He will denote the Von Neumann entropy of the 
density matrix pe at Bob's side, while Hy will denote the 
Shannon differential entropy of Bob's measurements. 

Alice modulates the two quadratures Qx and Px of the 
coherent states she sends with random values following 
Gaussian distribution. To simplify the analysis, we will 
assume this modulation to be symmetric in Q and P. 

If Bob performs a heterodyne measurement, he gets 
the two noisy measurements Qy*^* = Qe+Qnoise 

andPij*^* = 

Pb + Pnoise/ where Qnoise and Pnoise are two independent 
Gaussian random variables of variance 1. (The units 
used in this letter correspond to a unity variance of the 
vacuum.) If he performs a homodyne measurement, 
he perfectly measures one quadrature — let say Q — 
and obtains no information on the other — P. One has 
therefore Q^°" = Qb and P^"*" = Pnoise (or, of course, the 
symmetric case, where Pjj"'" = Pb and Q^°"' = Qnoise)- 
The lossy channel is modeled by a beamsplitter of 
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transmitivity T and reflectivity 1 - T, the reflected beam 
being given to Eve. In the equivalent entanglement- 
based scheme 1 15], this attack gives Eve the purification 
of the mixed state p®g shared by Alice and Bob. Eve 
then performs a collective measurement on her part of 
the purification, after Alice and Bob's classical commu- 
nication has occurred. As shown below, this attack is 
more powerful than the ones studied in LI. .Z .3.. A .1 ill . 
However, this attack model is not generic in two aspects. 

First, the channel model itself is not generic, since we 
restrict ourselves to the lossy channel and omit to con- 
sider nonzero added-noise and non-Gaussian attacks. 
This restriction is only due to brevity consideration and 
will be lifted in a longer article [16], which will also con- 
tain a study of squeezed states protocols. Of course, in 
an experiment, the amount of added noise has to be mea- 
sured by Alice and Bob through some sampling and will 
never be exactly zero. They would thus have to use the 
more general results of [16]. 

A more fundamental restriction comes from the fact 
that we suppose Alice and Bob share a state of the form 
p^g. hi other words, we restrict Eve to individual attacks 
on the charmel, even if she is allowed to make collective 
measurements on the ancillas obtained through these at- 
tacks. This restriction will be lifted at the end of this let- 
ter, where we apply the generic security proof 1 4] which 
does not rely on any assumption about Eve's attack. 

Entropies and mutual information. Let Vq^ (Vpb) be the 
variance in the Q-quadrature (in the P-quadrature) of 
the Gaussian state pe- Since squeezing is a reversible 
operation, it doesn't alter the Von Neumann entropy of 
Pb, which is an increasing fimction of Vb := V^Qb 



HB = ^logi^-^logiV 
.logi^ + Z^logl±l^ 



(1) 



The logarithms in the above expression should be taken 
in base 2 if one wants the result in bits, or in base e if one 
wants it in nats. For strong modulation (Vb s> 1), one 
will use the Taylor expansion 

He = log + log 1+0(4). 

Let Vqy and Vpy be the variances of Bob's two orthogo- 
nal quadrature measurements. The Shannon differential 
entropy Hy is simply the logarithm of Vy '■= ^JVQyVp^, 
up to an arbitrary additive constant llSll . which can be 
set to 0: 



Hv = log Vv. 



(2) 



The rate of common information Alice and Bob can 
extract from their classical values is given by the mutual 
information [18] 

^X;Y := Hy - Hy|x = Hx + Hy - Hxy- 



If Bob uses a heterodyne detection, which adds a unit of 
noise, Vy*^' - Vb + 1- Since a coherent state sent through 
a lossy channel stays a coherent state, the conditional 
variance are Vb\x - 1 and VyJ^^ - Vb\x + 1=2. One has 
therefore 
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het 
X;Y 



log^. 



(3) 



If Bob is allowed to make arbitrary measurements on 
the pulses, the information they share is then given by 
the Holevo information 11^ 12011 



lX;B '■= Hb - Hb|X, 

which is attained by collective measurements. Since Bob 
receives pure (coherent) states, Hb|x ~ and 



h;B = Hb = Ix;Y + T-I/Vb ' 

If Vb » 1/ one has 



1+1/Vb 



(4) 



(5) 



Therefore, by using heterodyne detection instead of the 
optimal collective measurement. Bob loses an amount of 
information up to log e {i.e. 1 nat 1.44 bits) per pulse. 

Direct key distribution. To attain the rate Jx;Y/ Alice and 
Bob can use random codes of size exp(n/x;Y)/ where the 
basis of the logarithms and the exponential are the same. 
Devetak and Winter have recently shown fl^ that Alice 
can divide this code into privacy amplification subsets 
of size close to exp(n7x;E)- This allows Alice and Bob 
to generate a secret key through a direct reconciliation 
procedure using only forward communication. This key 
can be generated at a rate asymptotically close to 



AI> := Ix;Y - -fX;E- 



(6) 



If Bob makes the optimal collective measurement, sub- 
stituting — ^X;B in the above expression and using 

equation il (with Vb = TVA+l-Tand Ve = (l-T)yA+T) 
gives us the attainable direct reconciliation key rate. At 
the high modulation limit, where Va ^ ^/T;l/{1 - T), 
one has ],22i 



AC'i = log^+0({i + il^}4). 



This limit is the same as the one foimd assuming Bob 
and Eve are restricted to heterodyne measurements 0] 
(individual attacks). 

Direct heterodyne key distribution. The equation J6) can 
be applied to the case where Bob uses heterod5me detec- 
tion We have then a lossy channel of transmission 
T between Alice and Bob and another lossy channel of 
transmission 1 - T between Alice and Eve. We can there- 
fore use the equations l|3j and JIJ to expand this expres- 
sion into 



A/het = loe ii5±i - ^—2 loe - 



-1/Ve 
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As shown by equation 0, Eve can gain up to 1 nat 
per pulse by using collective measurement. The best 
situation for Alice and Bob is the high modulation limit 
^ jhff where 



At'' = loi 



It is therefore not possible to perform direct heterodyne 
QKD if the channel transmission is smaller than T^^^ - 

^ mm 

e/(e + 1) 0.73. These maximal losses of 1.4 dB imply 
a shorter range for this protocol than the 3 dB deduced 
if one only considers individual attacks or if Bob uses 
optimal collective measurements. 

Direct homodyne key distribution. Surprisingly, the 
original proposal 1 1 J of direct homodyne QKD is more ro- 
bust. For those protocols, Alice modulates both quadra- 
tures Q and P with the same variance Vp, and Bob chooses 
randomly one quadrature to measure (let say Q). After 
the public disclosure of this quadrature choice, the in- 
formation on P is useless and can be forgotten by Alice. 
The state she has sent to Bob is therefore a mixture of co- 
herent states with a given value of Q but different values 
of P. The mixture received by Bob is a Gaussian mixed 

1 and V^''!^ = Vb, therefore 

Vb. When V^b » 1, one has [22J 



states with variances V]^"^ 



T/hom 
B|X 



H^- = logVv^ + logf+6)(^) 
H^°- = logyB + logf +6>(^) 



(7) 



j-hom 
^X;B 



ilogl/B+0(^) = /5^?- + 0(^). 



Thus, collective measurements only give a small amount 
(of order 1/ of supplementary information over 
homodyne detection, the noise in the useless quadrature 
(P) plays a crucial role in this. 

Eve receives similar mixed states, and, in the strong 
modulation regime (Va » 1 /(I - T)), one has 



AZ^-=llog^+0(j^ 



\I1-T 



VVa/' 



The advantage given to Eve by collective measurements 
is therefore of order 1 / arid can be arbitrarily re- 
duced by Alice's use of a strong enough modulation. 
Therefore, unlike the heterodyne protocol, the key rate of 
the direct homodyne key distribution protocol remains 
almost imchanged when compared to |1], where Eve 
was restricted to (postponed) homodyne measurements. 
More specifically the range limit of this protocol stays at 
3 dB (50 %) of losses, whether one considers collective 
measurements or not. 

Reverse key generation. For symmetry reasons, back- 
ward communication is needed distribute a quantum 
key beyond this 3 dB limit. Either postselection 18,13] 
or a reverse reconciliation procedure L2,^i9J can be used 



for this purpose. In the latter case, the attainable rate is 
given by L21J 

AI<3 := Ix;Y - h;E- 

If Bob performs an optimal collective measurement, 
one has to replace the above expression by /x;b - Ib;E, 
where /b;E is the quantum mutual information 

Ib;E '■= Hb + He - Hbe- 

Since the joint state pBE is obtained by the (reversible) 
mixture of pA and a vacuum state in the mode N, one 
has Hbe - Ha + Hn - Ha- At the high modulation limit 
(Va » 1/T; 1/(1 - T)), one has therefore jH 

/b;E = log Va + log r(l - T)f + + ^} 



AJfUlog^+6>({l + iI^}^) 



which is, like in the direct case, very close to the result 
obtained with heterodyne detection in an individual at- 
tacks scenario |3]. For strong losses (1/Va T <^ 1), 
this expression becomes 

A/fi = Tloge + 6)(r2 + ^). 

Reverse heterodyne key generation. In the heterodyne 
case 121, which is symmetric in Q and P, one has 



T/het _ T/het ._ t/ (QeQy")- 2-T+T/Va 



r+(2-T)/yA ' 



(i-r)(i-i/yA) 1+1/Va 

-I- T- , « nr^ log ^ 



When Va ^ 1/T/ this expression becomes 

Hhf*=logl-I-ilog(l-T)+6>(^). 

If one also has 1/a » 1/(1 - T), IH 

He = log Va + log 1(1 - T) + 0{^^) 
I^^ = log f TVa + i log(l - T) + 6>({i + ^}^) 



At'' = i log ^ - loge + + jhr)^) 



As in the direct case. Eve gains a finite amoimt of in- 
formation by using collective measurement instead of 
heterodyne measurements. However this gain is not 
sufficient to reduce the range of the protocol, which 
still works for arbitrary long ranges. For strong losses 
(I/Va ^ T <^ 1), the rate is twice smaller than the col- 
lective measurement rate 

AI^^' = lrioge + 6>(r2 + ^)-lA/fi. 
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Reverse homodyne key generation In the homodyne 
case 1 2], similar calculations give us: 

T^hom _ 1 

"^QeIY - T+{1-T)/Va 

V^l^ = Ve^{1- T)V/, + T 

T/hom _ /t^ 1-T+T/V^ 
^ E|Y ~ A/ ^ '^T+{l-T)/V^ 

In the large modulation limit (Va » l/T; 1/(1 - T)) 121 , 

^ErY"= V^[l+^(iT + T^l!^)] 
= i log I-IVa + log f + + 

i^- = 1 iog(i - T)ryA + + 

A rhom _ 1 1q„ J_ , /^/^ , / T 

As for the direct case, the use of homodyne detection by 
Alice and Bob allows them to reduce the advantage given 
to Eve by coherent measurement to an arbitrarily small 
amount and to attain a secret key rate arbitrarily close to 
the one given in |2], where only individual attacks were 
considered. In the strong losses regime {l/V/\ <^ T <^ 1), 
the rate obtained is almost equal to the one obtained in 
heterodyne measurements: 

A/ho- = irioge + 0(t^ + rk) " 

The (almost) factor 2 advantage in rate given by het- 
erodyne measurement at low losses cancels for strong 
losses. The use of the homodyne setup is also attractive 
in experimental QKD because of the sensitivity of the 
current continuous variable reconciliation algorithms 
113.13 to the signal-to-noise ratio. 

Unconditional security One can also compare these 
rates to the unconditionaly secure rates S obtained from 
the generic security proof of Christiandl et al. (3] 

S = Jx;Y-He, (8) 

which is independent of the reconciliation direction. 
Since Alice sends coherent states, as shown above He = 
Ix;E and this unconditional secure rate is equal to the 
direct reconciliation rate AI^°'' (Alfj'^') when Bob makes 
collective (heterodyne) measurements, regardless of the 
actual reconciliation direction (direct or reverse). 

The role of the unmeasured (P-)quadrature modula- 
tion makes the homodyne case different. If it decreased 
the efficiency of the collective attacks considered above, 
it increases the entropy He, decreasing the secure rate S 
given by equation JS). However, giving the information 
about this modulation to Eve could only decrease the 
secret rate. He is then given by and, in the strong 
modulation regime (Va » 1/(1 - T)), ^ becomes Il22l1 

chom - _I_± . q{ 1 'l 



Unconditionally secure homodyne QKD is therefore 
possible if the channel transmission T is greater than 
= e2/(e2 -h 4) ^ 0.65 (1.9 dB) 

Conclusion We have quantified the effect of collec- 
tive attacks on coherent states based CV QKD proto- 
cols through a lossy channel. These attacks are strictly 
more powerful than the individual attacks studied be- 
fore. However, if Bob makes homodyne measurements, 
the advantage given to Eve by these attacks can be made 
arbitrarily small if Alice uses a strong modulation. On 
the contrary, if Bob uses heterodyne measurement, these 
attacks give a finite advantage to Eve. For comparison, 
we have computed the key rate in the (theoretical) opti- 
mal case, where Bob performs a collective measurement. 

We also have applied the generic security proof of 
Christiandl et al. |^ to compute an imconditional secure 
rate for these protocols. This rate is usually lower than 
the one obtained above, but, this bound being known 
not to be tight, this does not rule out the possibility for 
the considered collective attacks to be optimal. 
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